Every Indian who files a tax return, signs a GST form or bids for a government tender interacts with a company that plays a critical role in the process. And most of us would not even know who that company is, what it does, or why it is so important. What it does is vouch for trust online, through the digital certificates that assure a browser that a website and a signature are genuine. A handful of licensed certifying authorities sit behind that assurance, and the largest is eMudhra. This month, a serious security failure at eMudhra – not a hack, but private keys so weak that its certificates could be misused – pushed it into mainstream attention. In this piece for ThePrint, Vrinda Tulsian traces what went wrong, and shows that the warning signs had been there all along.
The story begins with an application to Mozilla in early 2018, in which eMudhra asked Firefox to trust its certificates and described itself as “a critical partner to Digital India”. It said it handled signatures for income tax, GST and customs filings, that it had issued 35 million certificates, “3 percent of India’s population”, and that its software was “used by the Indian Army and other defence establishments”. The volunteers who vet such applications, Tulsian writes, were “less certain”.
Behind the national-champion framing sits a tangled corporate history. eMudhra was born in 2008 as a subsidiary of 3i Infotech, sold in 2010, and is today controlled, to the tune of 54.4 percent, by the Srinivasan family and a Singapore entity. In February this year 3i Infotech filed a police complaint accusing eMudhra and its chairman of fraud worth Rs 128 crore; the company called it baseless, and the police closed it as a civil dispute. “When 3i Infotech, another listed company, filed this, nobody noticed,” the researcher Srikanth tells ThePrint. “There was no scrutiny, and eMudhra has by and large been a monopoly in the Indian Digital Signature Certificates market.”
That dominance is the real story. eMudhra holds 37.9 percent of India’s digital-signature market, was the first to offer Aadhaar-based eSign, and used its standing at home to win American university business and the trust of at least seven Indian banks. Then came the failure. The keys were generated at an April 2025 “ceremony”; a faulty script, eMudhra now says, produced a second, weaker set that staff used “by mistake”. An official conceded “there were human errors in multiple steps of the process”, adding that the firm had since checked its other keys, “corroborated primarily using mathematical models facilitated by AI”. Mozilla’s Dennis Jackson was blunter: because anyone could recover the keys, “the impact of this incident could not be higher”.
What lingers is the governance question. India’s IT ministry has set up a team to investigate, but says it was not involved in auditing the failed business. The IT Ministry’s reassurance that signature services are unaffected rests, Tulsian notes, on eMudhra’s own account. A cybersecurity researcher who asked not to be named put it plainly: “If you’ve made this mistake once, the question is about processes and trust. There has to be a no-holds-barred review of the entire company’s operations… and it has to be fully transparent.”
Tulsian ends on a detail that should worry anyone who took the reassurances at face value. In 2018, eMudhra won Mozilla’s trust partly by arguing that its Indian business was government-regulated and quite separate from the new global certificates it wanted recognised. This week, as those global certificates failed, the government reassured the public in almost identical terms: the Indian signature services are separate, and unaffected. The argument once used to wave eMudhra in is now the one being used to calm everyone down.
If you want to read our other published material, please visit https://marcellus.in/blog/
Note: The above material is neither investment research, nor financial advice. Marcellus does not seek payment for or business from this publication in any shape or form. The information provided is intended for educational purposes only. Marcellus Investment Managers is regulated by the Securities and Exchange Board of India (SEBI) and is also an FME (Non-Retail) with the International Financial Services Centres Authority (IFSCA) as a provider of Portfolio Management Services. Additionally, Marcellus is also registered with US Securities and Exchange Commission (“US SEC”) as an Investment Advisor.
